Governance Principles Flashcards

A CGRC practitioner is advising a federal agency whose Authorizing Official (AO) delegated authority to a Designated Authorizing Official Representative (DAOR). The DAOR signs an authorization decision accepting a risk that the AO's own risk-tolerance statement classifies as 'high-impact, enterprise-level.' Under NIST SP 800-37 Rev. 2 governance principles, what is the correct assessment?

Answer: The decision is invalid because the AO role cannot be delegated for the final authorization decision, which includes the acceptance of risk, even though the DAOR may prepare for and support it

NIST SP 800-37 Rev. 2 allows the AO to delegate many tasks to a DAOR, but the final authorization decision (and acceptance of risk) is an inherently governmental, non-delegable responsibility of the AO. A DAOR may not issue the authorization decision, so a risk acceptance signed solely by the DAOR does not satisfy governance requirements.

An organization operates under a three-tiered risk management approach (NIST SP 800-39). A system-level team discovers that a mission/business process (Tier 2) assumption about acceptable data-loss tolerance conflicts with the organization's risk tolerance set at Tier 1. According to governance principles, which action is MOST appropriate?

Answer: Escalate the conflict for resolution so the Tier 2 assumption is reconciled with the Tier 1 risk tolerance, since risk decisions at lower tiers must be consistent with organization-level strategy and tolerance

In the multitiered risk management model, Tier 1 (organization) establishes risk tolerance, strategy, and governance that constrain Tier 2 and Tier 3 decisions. Conflicts must flow upward for reconciliation. A POA&M tracks weaknesses and not governance conflicts, and local waivers cannot override organization-level tolerance.

A company's board delegates enterprise risk oversight to an audit committee. The CISO reports security metrics only to the CIO, who filters them before sharing with the committee. Which governance principle is MOST directly undermined, and what is the best corrective measure?

Answer: Independence and unfiltered accountability reporting; establish a direct reporting line or unfiltered communication channel from the CISO to the board or audit committee

Effective governance requires that those charged with oversight receive complete, objective, and timely risk information. Filtering through an interested executive compromises independence and transparency. A direct or unfiltered reporting channel (or at minimum, unaltered reporting) to the board addresses the root cause. The other options are technical or role-segregation concepts that do not address the reporting flaw.

During continuous monitoring, an organization's governance framework requires that a significant change to a system trigger reauthorization consideration. Which scenario BEST demonstrates a governance-appropriate response under a risk-based ongoing authorization approach?

Answer: The ISSO assesses the change's security impact, informs the AO through the defined governance channels, and the AO determines whether the risk posture remains within tolerance or whether a targeted reassessment and updated authorization decision are required

Under ongoing authorization, significant changes feed a defined impact analysis whose results are communicated to the AO, who retains authority to determine whether risk remains acceptable and whether reassessment or updated authorization is needed. Self-determining the change as minor or relying only on scan results bypasses governance, and an assessor lacks authority to revoke an ATO.

An organization identifies a common control provided by a shared-services enterprise provider that is inherited by 40 systems. The provider's assessment shows the control is only partially effective. From a governance perspective, who is responsible for ensuring this deficiency is considered in each inheriting system's authorization?

Answer: Each inheriting system's AO, supported by the system owner, who must account for the common control's deficiency in the system's risk determination, while the common control provider remains accountable for remediating the control

Common control providers are responsible for implementing, assessing, and monitoring the controls they offer, and must share assessment results and POA&Ms with inheriting system owners. However, the AO of each inheriting system remains accountable for the risk to that system, so the inherited control's weakness must be factored into the system-level authorization decision.

An organization with a mature governance program finds that risk executive (function) decisions are inconsistently applied: two AOs accepted materially different residual risk for near-identical systems with the same threat exposure. What governance mechanism BEST addresses this inconsistency?

Answer: Have the risk executive (function) establish and communicate organization-wide risk tolerance, risk-acceptance criteria, and a consistent, organization-level view of risk to inform and calibrate individual authorization decisions

The risk executive (function) provides a consistent, organization-wide perspective on risk, ensuring that authorization decisions align with organizational risk tolerance and strategy. Establishing clear tolerance and acceptance criteria promotes consistency without removing AO accountability. Hiding data, eliminating risk acceptance, or centralizing every decision is impractical or counterproductive.